Implementing API Security

@Bean
CorsConfigurationSource corsConfig() {
    var c = new CorsConfiguration();
    c.setAllowedOrigins(List.of("https://app.acme.com"));
    c.setAllowedMethods(List.of("GET","POST","PUT","DELETE","PATCH"));
    c.setAllowedHeaders(List.of("Authorization","Content-Type","X-Correlation-Id"));
    c.setExposedHeaders(List.of("X-Correlation-Id"));
    c.setAllowCredentials(true);
    c.setMaxAge(3600L);
    var src = new UrlBasedCorsConfigurationSource();
    src.registerCorsConfiguration("/**", c);
    return src;
}

String stringToSign = method + "\n" + path + "\n" + timestamp + "\n" + sha256(body);
String expected = base64(hmacSha256(secret, stringToSign));
if (!MessageDigest.isEqual(expected.getBytes(), provided.getBytes()))
    throw new UnauthorizedException("bad signature");
if (Math.abs(now - timestamp) > 300_000) throw new UnauthorizedException("stale");